NETOBSERV-2515: Add TLS support for collector when OpenShift - #552
NETOBSERV-2515: Add TLS support for collector when OpenShift#552leandroberetta wants to merge 2 commits into
Conversation
|
@leandroberetta: This pull request references NETOBSERV-2515 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target either version "5.0.0." or "openshift-5.0.0.", but it targets "netobserv-2.0" instead. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@leandroberetta: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| sigs.k8s.io/yaml v1.6.0 // indirect | ||
| ) | ||
|
|
||
| replace github.com/netobserv/flowlogs-pipeline => github.com/leandroberetta/flowlogs-pipeline v0.0.0-20260810170916-6c5c94ab0294 |
There was a problem hiding this comment.
Don't forget to remove this :)
There was a problem hiding this comment.
that deserve at least a unit test
| if [[ "$tlsEnabled" == "true" ]]; then | ||
| cmd="${K8S_CLI_BIN} run -n $namespace collector \\ | ||
| --image=$img --image-pull-policy='Always' --restart='Never' \\ | ||
| --override-type=strategic \\ | ||
| --overrides=$overrides \\ | ||
| --command -- $runCommand" | ||
| else | ||
| cmd="${K8S_CLI_BIN} run -n $namespace collector \\ | ||
| --image=$img --image-pull-policy='Always' --restart='Never' \\ | ||
| --overrides=$overrides \\ | ||
| --command -- $runCommand" | ||
| fi |
There was a problem hiding this comment.
| if [[ "$tlsEnabled" == "true" ]]; then | |
| cmd="${K8S_CLI_BIN} run -n $namespace collector \\ | |
| --image=$img --image-pull-policy='Always' --restart='Never' \\ | |
| --override-type=strategic \\ | |
| --overrides=$overrides \\ | |
| --command -- $runCommand" | |
| else | |
| cmd="${K8S_CLI_BIN} run -n $namespace collector \\ | |
| --image=$img --image-pull-policy='Always' --restart='Never' \\ | |
| --overrides=$overrides \\ | |
| --command -- $runCommand" | |
| fi | |
| overrideType="" | |
| if [[ "$tlsEnabled" == "true" ]]; then | |
| overrideType="--override-type=strategic" | |
| fi | |
| cmd="${K8S_CLI_BIN} run -n $namespace collector \ | |
| --image=$img --image-pull-policy='Always' --restart='Never' \ | |
| $overrideType --overrides=$overrides \ | |
| --command -- $runCommand" |
| if [ "$command" = "flows" ]; then | ||
| echo "creating collector service" | ||
| applyYAML "$collectorServiceYAML" | ||
| if [[ "$tlsEnabled" == "true" ]]; then | ||
| echo "creating CA configmap for TLS" | ||
| createCAConfigMap | ||
| fi | ||
| echo "creating flow-capture agents" | ||
| elif [ "$command" = "packets" ]; then | ||
| echo "creating collector service" | ||
| applyYAML "$collectorServiceYAML" | ||
| if [[ "$tlsEnabled" == "true" ]]; then | ||
| echo "creating CA configmap for TLS" | ||
| createCAConfigMap | ||
| fi | ||
| echo "creating packet-capture agents" | ||
| elif [ "$command" = "metrics" ]; then | ||
| echo "creating service monitor" | ||
| applyYAML "$smYAML" | ||
| echo "creating metric-capture agents:" |
There was a problem hiding this comment.
We should simplify this to something like:
# Create collector service for flows/packets captures
if [[ "$command" = "flows" || "$command" = "packets" ]]; then
echo "creating collector service"
applyYAML "$collectorServiceYAML"
if [[ "$tlsEnabled" == "true" ]]; then
echo "creating CA configmap for TLS"
createCAConfigMap
fi
fi
if [ "$command" = "flows" ]; then
echo "creating flow-capture agents"
elif [ "$command" = "packets" ]; then
echo "creating packet-capture agents"
elif [ "$command" = "metrics" ]; then
echo "creating service monitor"
applyYAML "$smYAML"
echo "creating metric-capture agents:"
| function isOpenShift() { | ||
| ${K8S_CLI_BIN} get clusterversion version &>/dev/null | ||
| } |
There was a problem hiding this comment.
You should rely on checkClusterVersion here instead.
Feel free to add a global variable like isOCP in it for your usage 😉
| golang.org/x/tools v0.45.0 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect | ||
| google.golang.org/grpc v1.81.1 // indirect | ||
| google.golang.org/grpc v1.82.0 |
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
Description
Enable TLS for the gRPC collector server when running on OpenShift, using service-ca for automatic cert generation
Conditionally detect OpenShift and annotate the collector Service for cert generation, create a CA ConfigMap with inject-cabundle, and mount certs in the collector pod
Add CA volume and tls.caCertPath to the agent DaemonSet FLP config so agents verify the collector's certificate
On non-OpenShift clusters, everything works without TLS as before
Test plan
Dependencies
n/a
Checklist